Skip to content

Build cspo Image

Build cspo Image #155

Workflow file for this run

name: Build cspo Image
# yamllint disable rule:line-length
on: # yamllint disable-line rule:truthy
push:
branches:
- main
# If the cache was cleaned we should re-build the cache with the latest commit
workflow_run:
workflows:
- "cspo Image Cache Cleaner"
branches:
- main
types:
- completed
workflow_dispatch:
env:
REGISTRY: ghcr.io/sovereigncloudstack
metadata_flavor: latest=true
metadata_tags: type=sha,prefix=sha-,format=short
permissions:
contents: read
packages: write
# Required to generate OIDC tokens for `sigstore/cosign-installer` authentication
id-token: write
jobs:
manager-image:
name: Build and push manager image
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4
with:
fetch-depth: 0
- name: Setup Go
uses: ./.github/actions/setup-go
- name: Set up QEMU
uses: docker/setup-qemu-action@49b3bc8e6bdd4a60e6116a5414239cba5943d3cf # v3
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3
- name: Generate metadata cspo
id: metacspo
uses: ./.github/actions/metadata
env:
IMAGE_NAME: cspo-staging
with:
metadata_flavor: ${{ env.metadata_flavor }}
metadata_tags: ${{ env.metadata_tags }}
- name: Login to ghcr.io for CI
uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
with:
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Install Cosign
uses: sigstore/cosign-installer@4959ce089c160fddf62f7b42464195ba1a56d382 # v3.6.0
- name: Install Bom
shell: bash
run: |
curl -L https://github.com/kubernetes-sigs/bom/releases/download/v0.5.1/bom-amd64-linux -o bom
sudo mv ./bom /usr/local/bin/bom
sudo chmod +x /usr/local/bin/bom
- name: Setup Env
run: |
echo 'DOCKER_BUILD_LDFLAGS<<EOF' >> $GITHUB_ENV
echo $DOCKER_BUILD_LDFLAGS >> $GITHUB_ENV
echo 'EOF' >> $GITHUB_ENV
# Load Golang cache build from GitHub
- name: Load cspo Golang cache build from GitHub
uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
id: cache
with:
path: /tmp/.cache/cspo
key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-cspo-${{ github.sha }}
restore-keys: |
${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-cspo-
${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}-
${{ runner.os }}-go-
- name: Create cspo cache directory
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
shell: bash
run: |
mkdir -p /tmp/.cache/cspo
# Import GitHub's cache build to docker cache
- name: Copy cspo Golang cache to docker cache
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
with:
provenance: false
context: /tmp/.cache/cspo
file: ./images/cache/Dockerfile
push: false
platforms: linux/amd64
target: import-cache
- name: Build and push cspo image
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6
id: docker_build_release_cspo
with:
provenance: false
context: .
file: ./images/cspo/Dockerfile
push: true
build-args: |
LDFLAGS=${{ env.DOCKER_BUILD_LDFLAGS }}
tags: ${{ steps.metacspo.outputs.tags }}
labels: ${{ steps.metacspo.outputs.labels }}
platforms: linux/amd64
- name: Sign Container Images
env:
COSIGN_EXPERIMENTAL: "true"
run: |
cosign sign --yes ghcr.io/sovereigncloudstack/cspo-staging@${{ steps.docker_build_release_cspo.outputs.digest }}
- name: Generate SBOM
shell: bash
run: |
bom generate -o sbom_ci_main_cspo_${{ steps.metacspo.outputs.version }}.spdx \
--image=ghcr.io/sovereigncloudstack/cspo-staging:${{ steps.metacspo.outputs.version }}
- name: Attach SBOM to Container Images
run: |
cosign attach sbom --sbom sbom_ci_main_cspo_${{ steps.metacspo.outputs.version }}.spdx ghcr.io/sovereigncloudstack/cspo-staging@${{ steps.docker_build_release_cspo.outputs.digest }}
- name: Sign SBOM Images
run: |
docker_build_release_cspo_digest="${{ steps.docker_build_release_cspo.outputs.digest }}"
image_name="ghcr.io/sovereigncloudstack/cspo-staging:${docker_build_release_cspo_digest/:/-}.sbom"
docker_build_release_cspo_sbom_digest="sha256:$(docker buildx imagetools inspect --raw ${image_name} | sha256sum | head -c 64)"
cosign sign --yes "ghcr.io/sovereigncloudstack/cspo-staging@${docker_build_release_cspo_sbom_digest}"
- name: Image Releases digests cspo
shell: bash
run: |
mkdir -p image-digest/
echo "ghcr.io/sovereigncloudstack/cspo-staging:{{ steps.metacspo.outputs.tags }}@${{ steps.docker_build_release_cspo.outputs.digest }}" >> image-digest/cspo.txt
# Upload artifact digests
- name: Upload artifact digests
uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
with:
name: image-digest
path: image-digest
retention-days: 90
# Store docker's golang's cache build locally only on the main branch
- name: Store cspo Golang cache build locally
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
with:
provenance: false
context: .
file: ./images/cache/Dockerfile
push: false
outputs: type=local,dest=/tmp/docker-cache-cspo
platforms: linux/amd64
target: export-cache
# Store docker's golang's cache build locally only on the main branch
- name: Store cspo Golang cache in GitHub cache path
if: ${{ steps.cache.outputs.cache-hit != 'true' }}
shell: bash
run: |
mkdir -p /tmp/.cache/cspo/
if [ -f /tmp/docker-cache-cspo/tmp/go-build-cache.tar.gz ]; then
cp /tmp/docker-cache-cspo/tmp/go-build-cache.tar.gz /tmp/.cache/cspo/
fi
if [ -f /tmp/docker-cache-cspo/tmp/go-pkg-cache.tar.gz ]; then
cp /tmp/docker-cache-cspo/tmp/go-pkg-cache.tar.gz /tmp/.cache/cspo/
fi
- name: Image Digests Output
shell: bash
run: |
cd image-digest/
find -type f | sort | xargs -d '\n' cat